GitHub Advisoryadvisory · Packagist

GHSA-8c6q-26w6-qwhg Easy!Appointments Improper Access Control vulnerability

MEDIUM Published 2023-07-17 Modified 2023-07-17 Official page ↗
Aliases
CVE-2023-3700
Ecosystem
Packagist
Packages
alextselegidis/easyappointments
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-284, CWE-639
Reviewed
2023-07-17

Affected packages

• Packagist alextselegidis/easyappointments: < 1.5.0 → fixed in 1.5.0

Description

Easy!Appointments 1.4.3 and prior has an Improper Access Control vulnerability. This issue is patched at commit b37b46019553089db4f22eb2fe998bca84b2cb64 and anticipated to be part of version 1.5.0.

Related

Alias · CVE (1)

  • CVE-2023-3700 Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References